Regsvr32 Squiblydoo Remote COM Scriptlet Loading T1218.010
Detects the use of regsvr32.exe to execute remote scriptlets (SCT files) via HTTP, HTTPS, or FTP protocols. This technique, often referred to as 'Squiblydoo', allows for proxying code execution to bypass application whitelisting and execute arbitrary code directly from a remote web server without writing the script to the local disk.
SentinelOne
